Credential stuffing

Credential stuffing is a type of cyberattack where stolen account credentials typically consisting of lists of usernames and/or email addresses and the corresponding passwords (often from a data breach) are used to gain unauthorized access to user accounts through large-scale automated login requests directed against a web application.[1] Unlike credential cracking, credential stuffing attacks do not attempt to brute force or guess any passwords - the attacker simply automates the logins for thousands to millions of previously discovered credential pairs using standard web automation tools like Selenium, cURL, PhantomJS or tools designed specifically for these types of attacks like Sentry MBA[2][3]

Credential Stuffing attacks are possible because many users reuse the same username/password combination across multiple sites, with one survey reporting that 81% of users have reused a password across two or more sites and 25% of users use the same password across a majority of their accounts.[4]

Contents

Credential stuffing attacks are considered among the top threats for web and mobile applications as a result of the volume of credential spills. More than 3 billion credentials were spilled through online data breaches in 2016 alone.[5]

On the 20 August 2018 Superdrug of the UK was targeted with an attempted blackmail, evidence was provided claiming to show that hackers had penetrated the site and downloaded 20,000 users records. The evidence was most likely obtained from hacks and spillages and then used as the source for credential stuffing attacks to glean information to create the bogus evidence.[7][8]

In October–November 2016, attackers gained access to a private GitHub repository used by Uber (Uber BV and Uber UK) developers, using employees' usernames and passwords that had been compromised in previous breaches. The hackers claimed to have hijacked 12 employees' user accounts using the credential stuffing method, as email addresses and passwords had been re-used on other platforms. Multi-/two-factor authentication, though available, was not activated for the affected accounts. The hackers subsequently located credentials for the company's AWS datastore in the repository files, and were therefore able to obtain access to the records of 32 million non-US users and 3.7 million non-US drivers, as well as other data contained in over 100 S3 buckets. The attackers alerted Uber, demanding payment of $100,000 to agree to delete the data. The company paid through a 'bug bounty program', but did not disclose the incident to affected parties for over a year. After the breach came to light, the company was fined £385,000 (downsizeable to £308,000) by the UK Information Commissioner's Office.[9]